SEC Begins Cyber Sweep of Investment Advisers with Focus on Cloud Storage

A sweep of investment advisers is underway by the U.S. Securities and Exchange Commission, which has sent out many letters to firms over the last week requesting information about their use of cloud providers.

The move could be part of the SEC’s Phase 3 Cybersecurity Exam Initiative, and is likely related to the April Regulation S-P Risk Alert about how firms are protecting personally identifiable information (PII) they store on cloud provider systems. Relatedly, the SEC may be interested in collecting information on whether firms are disclosing cloud vendors on Form ADV Schedule D, Item 1.L.

Many filers do not disclose cloud vendors on Form ADV, since the question asks for the location of books and records other than your office or principal place of business, and technically, records on cloud systems are accessible from a registrant’s office through a web browser. The Omgeo No-Action Letter from August 2009 permits advisers to store records in the cloud as long as the adviser can access those records from their office. Typically, we see firms disclose on the ADV the location of hard copy records, CDs, etc., at Iron Mountain or other physical storage vendors, as well as the locations of any alternate office locations at which original records are kept. Some firms do disclose cloud providers such as Global Relay, Smarsh and Mimecast, etc. although most don’t. SEC staff stated at a recent conference that it has observed an increased use of cloud providers by registrants.

Firms are using so many cloud vendors from portfolio management systems to Office365 to Dropbox to CSS’ own Ascendant Compliance Manager that the list in Section 1.L would likely be dozens of entries if every firm disclosed every location of electronic records. The SEC is interested in learning whether advisers have a handle on all the locations they are storing PII and other sensitive data. And in a new OCIE Risk Alert released May 23, 2019, “Safeguarding Customer Records and Information in Network Storage,” it is clear that the SEC is also focusing on whether advisers and broker-dealers have properly configured data storage solutions to use available security features to safeguard against unauthorized access. Maintaining a current data inventory of the locations of PII and which data is stored where, as well as conducting adequate oversight of these third party cloud providers, are essential components of a reasonably designed cybersecurity program.


CSS is currently running a “Getting Practical with Cyber” series of webinars. Our next, “In the Driver’s Seat: Your Critical Role in Cyber Resiliency,” takes place on June 11 at 2 pm ET. Register by clicking here.

For more information on how CSS can help you evaluate your cybersecurity program, visit our Shield page.


Subscribe to CSS Blog

CSS frequently publishes blog posts which are written by our team from their observations in the field, at conferences and through experiences with compliance professionals. These posts are designed to further knowledge and share industry best practices. Topics run the gamut, including Form ADV, cybersecurity, MiFID II, position limit monitoring, technology challenges and more. Complete and submit the brief form below to receive notifications when we publish new content.

Loading form...

Latest Content

Form CRS and Its Impact on State-Registered Advisers

While many investment advisers are starting to plan for Form CRS/Form ADV Part 3, one group of investment advisers can breathe a sigh of relief that this is a project that does not need to be on their ‘To Do’ list. As of now, no state regulator has adopted this disclosure document for state-registered advisers. … Continued

Effective Compliance Policies & Procedures and Annual Reviews: Meeting the Reasonably Designed Standards

Investment Advisers must perform an annual evaluation of the effectiveness of their compliance program. This starts with ensuring, maintaining and implementing reasonably designed policies and procedures. This ComplianceCast webinar covers the recent regulatory changes that may trigger a need to reevaluate your present policies. Who Conducts and How to Conduct the Annual Review Planning and … Continued

7 Reasons to Attend Our Scottsdale Fall 2019 Compliance Conference

If you’ve been considering joining us in Scottsdale for our Sept. 23-25 compliance event, here are seven reasons you should take the plunge now! The Best Mix of Informational & Educational Speakers – We just added OCIE’s Co-National Associate Director of Investment Adviser/Investment Company Examination Program Marshall Gandy to our stellar list of presenters. He joins ex-NFL star Merril … Continued